CVE-2021-41174
grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 3, 2021
Updated · November 22, 2025
Description
A cross-site scripting (XSS) vulnerability in grafana allows an attacker to execute arbitrary JavaScript code in the browser of a victim user. An attacker may send a link referencing a page where the victim is unauthenticated and contains the login button and including interpolation binding expressions (e.g. {{ and }} in AngularJS) in the URL.
Statement
This issue did not affect the versions of grafana as shipped with Red Hat Enterprise Linux 8 as they provide an older version that does not include the vulnerability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')